Changeset 15832

Timestamp:

10/18/2010 11:44:19 AM (14 years ago)

Author:

dd32

Message:

Use $wpdb->prepare in wp_old_slug_redirect(). See #15140

File:

• trunk/wp-includes/query.php (modified) (1 diff)

trunk/wp-includes/query.php

@@ -3147 +3147 @@
         global $wpdb;
 
-        $query = "SELECT post_id FROM $wpdb->postmeta, $wpdb->posts WHERE ID = post_id AND meta_key = '_wp_old_slug' AND meta_value='" . $wp_query->query_vars['name'] . "'";
+        $query = $wpdb->prepare("SELECT post_id FROM $wpdb->postmeta, $wpdb->posts WHERE ID = post_id AND meta_key = '_wp_old_slug' AND meta_value=%s", $wp_query->query_vars['name']);
 
         // if year, monthnum, or day have been specified, make our query more precise
         // just in case there are multiple identical _wp_old_slug values
         if ( '' != $wp_query->query_vars['year'] )
-            $query .= " AND YEAR(post_date) = '{$wp_query->query_vars['year']}'";
+            $query .= $wpdb->prepare(" AND YEAR(post_date) = %d", $wp_query->query_vars['year']);
         if ( '' != $wp_query->query_vars['monthnum'] )
-            $query .= " AND MONTH(post_date) = '{$wp_query->query_vars['monthnum']}'";
+            $query .= $wpdb->prepare(" AND MONTH(post_date) = %d", $wp_query->query_vars['monthnum']);
         if ( '' != $wp_query->query_vars['day'] )
-            $query .= " AND DAYOFMONTH(post_date) = '{$wp_query->query_vars['day']}'";
+            $query .= $wpdb->prepare(" AND DAYOFMONTH(post_date) = %d", $wp_query->query_vars['day']);
 
         $id = (int) $wpdb->get_var($query);
 
-        if ( !$id )
+        if ( ! $id )
             return;